@getbrevo/cli 0.0.1-alpha.1

package/dist/templates/files/README.md.tmpl

@@ -0,0 +1,77 @@
+# {{APP_NAME}}
+
+Brevo OAuth integration scaffolded with the Brevo CLI.
+
+> **This is a starter / test app** to help you exercise the OAuth flow locally. Treat it as a reference — it is not intended for production use.
+
+## Setup
+
+1. Install dependencies for the oauth feature:
+
+   ```bash
+   yarn --cwd src/oauth install
+   # or: npm --prefix src/oauth install
+   ```
+
+2. Start the local OAuth test server (the CLI reads `app-config.json` for port and redirect URLs):
+
+   ```bash
+   brevo app start oauth
+   # or choose a port: brevo app start oauth --port 3000
+   ```
+
+3. Open the login URL printed by the CLI (typically `http://localhost:<port>/auth/login`). The OAuth server redirects back to `http://localhost:<port>/auth/callback` — make sure that URL is registered on your app's redirect list.
+
+## Project structure
+
+```
+.
+├── app-config.json           App config — ID, scopes, redirect URLs
+├── .gitignore                Ignores .env.local and build artefacts
+├── AGENTS.md                 AI agent guidance
+├── CLAUDE.md                 Claude Code guidance
+├── README.md                 (this file)
+└── src/
+    └── oauth/                Self-contained OAuth test feature
+        ├── package.json      Dependencies & `yarn start` script
+        ├── server.js         Test server entry point
+        ├── handler.js        OAuth routes (/auth/login, /auth/callback)
+        ├── token-store.js    In-memory token management
+        ├── .env.example      Credential template (committed)
+        └── .env.local        Local credentials (gitignored, chmod 600)
+```
+
+## Credentials
+
+- Client ID and secret are written to `src/oauth/.env.local` during scaffold (file permissions `600`).
+- Re-fetch them any time with `brevo app credentials --app-id {{APP_ID}} --reveal-secret`.
+- `.env.local` is in `.gitignore` — **never commit it**.
+
+## Security
+
+- Never commit `src/oauth/.env.local` — it contains your client secret.
+- The test server uses a random `state` parameter for CSRF protection and binds to localhost only.
+- Access tokens are kept in process memory; restarting the server clears them.
+
+## Updating your app
+
+Push changes to Brevo directly from the CLI:
+
+```bash
+brevo app update --name "New Name"
+brevo app update --redirect-url https://myapp.com/callback
+brevo app update --name "New Name" --redirect-url https://myapp.com/callback
+```
+
+`--redirect-url` is repeatable and **appends** to existing URLs. Running `brevo app update` without flags pushes the full `app-config.json`. When flags are provided, the local `app-config.json` is updated automatically after a successful API call.
+
+Outside this project directory, target an app by ID:
+
+```bash
+brevo app update --app-id {{APP_ID}} --name "New Name"
+```
+
+## Docs
+
+- [Brevo API Documentation](https://developers.brevo.com)
+- [Brevo CLI](https://github.com/getbrevo/brevo-cli)

package/dist/templates/files/app-config.json.tmpl

@@ -0,0 +1,23 @@
+{
+  "appId": "{{APP_ID}}",
+  "appName": "{{APP_NAME}}",
+  "auth": {
+    "type": "private",
+    "scopes": {{SCOPES_JSON}},
+    "redirectUrls": {{REDIRECT_URLS_JSON}}
+  },
+  "distribution": "private",
+  "permittedUrls": {
+    "fetch": [],
+    "img": [],
+    "iframe": [],
+    "js": [],
+    "css": []
+  },
+  "support": {
+    "supportEmail": "",
+    "documentationUrl": "",
+    "supportUrl": "",
+    "supportPhone": ""
+  }
+}

package/dist/templates/files/gitignore.tmpl

@@ -0,0 +1,9 @@
+# Local credentials — never commit
+src/oauth/.env.local
+
+# Dependencies
+node_modules/
+
+# Logs
+*.log
+npm-debug.log*

package/dist/templates/files/src/oauth/.env.example.tmpl

@@ -0,0 +1,13 @@
+# Brevo OAuth Credentials — copy this file to .env.local and fill in your values
+# Get CLIENT_ID and CLIENT_SECRET: brevo app credentials --reveal-secret
+
+CLIENT_ID=your_client_id_here
+CLIENT_SECRET=your_client_secret_here
+REDIRECT_URI={{REDIRECT_URI}}
+
+# OAuth server
+OAUTH_BASE={{OAUTH_BASE}}
+OAUTH_REALM={{OAUTH_REALM}}
+
+# Optional
+# PORT=3009

package/dist/templates/files/src/oauth/.env.local.tmpl

@@ -0,0 +1,10 @@
+# Local credentials — DO NOT COMMIT
+# Generated by: brevo app scaffold
+
+CLIENT_ID={{CLIENT_ID}}
+CLIENT_SECRET={{CLIENT_SECRET}}
+REDIRECT_URI={{REDIRECT_URI}}
+
+# OAuth server
+OAUTH_BASE={{OAUTH_BASE}}
+OAUTH_REALM={{OAUTH_REALM}}

package/dist/templates/files/src/oauth/handler.js.tmpl

@@ -0,0 +1,203 @@
+// Test handler — for local OAuth testing only. Not for production use.
+const fs = require('fs');
+const path = require('path');
+const express = require('express');
+const axios = require('axios');
+const tokenStore = require('./token-store');
+
+const router = express.Router();
+
+// Sanitise untrusted values before embedding in HTML to prevent XSS
+function escapeHtml(str) {
+  return String(str).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
+}
+
+// Shared styles for token display pages (callback + refresh)
+const PAGE_STYLES =
+  '<style>' +
+  '*,*::before,*::after{margin:0;padding:0;box-sizing:border-box}' +
+  'body{font-family:"Inter",-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,sans-serif;background:rgb(250,245,227);min-height:100vh;display:flex;flex-direction:column;align-items:center;justify-content:center;padding:40px 16px}' +
+  '.page-card{background:#fff;border:1px solid #e3e3e3;border-radius:16px;padding:40px;width:100%;max-width:560px;text-align:center}' +
+  '.page-card h2{color:#1b1b1b;font-size:22px;margin-bottom:8px}' +
+  '.page-card .subtitle{color:#696969;font-size:14px;margin-bottom:24px}' +
+  'a{color:#1b1b1b}' +
+  '.token-wrapper{position:relative;margin-top:6px}' +
+  '.token-value{display:block;padding:10px;background:#fff;border:1px solid #cfcfcf;border-radius:8px;font-family:monospace;font-size:13px;filter:blur(5px);user-select:none;cursor:pointer;transition:filter .2s}' +
+  '.token-value.revealed{filter:none;user-select:text;cursor:text}' +
+  '.reveal-btn{position:absolute;top:50%;left:50%;transform:translate(-50%,-50%);background:#1b1b1b;color:#fff;border:none;padding:8px 16px;border-radius:16px;font-size:13px;font-weight:600;cursor:pointer}' +
+  '.reveal-btn.hidden{display:none}' +
+  '.request-details{text-align:left;margin:16px 0;background:#f5f5f5;border:1px solid #e3e3e3;padding:16px 20px;border-radius:16px;font-size:13px}' +
+  '.request-details strong{color:#1b1b1b}' +
+  '.request-details dt{font-weight:600;margin-top:8px;color:#1b1b1b}' +
+  '.request-details dd{margin:2px 0 0 0;font-family:monospace;word-break:break-all;color:#696969}' +
+  '.token-section{text-align:left;margin:16px 0;background:#f5f5f5;border:1px solid #e3e3e3;padding:20px;border-radius:16px;word-break:break-all}' +
+  '.footer-text{color:#858585;font-size:12px;margin-top:16px}' +
+  '</style>';
+
+const REVEAL_SCRIPT =
+  '<script>document.querySelectorAll(".reveal-btn").forEach(function(btn){btn.addEventListener("click",function(){btn.parentElement.querySelector(".token-value").classList.add("revealed");btn.classList.add("hidden")})});</script>';
+
+const CLIENT_ID = process.env.CLIENT_ID;
+const CLIENT_SECRET = process.env.CLIENT_SECRET;
+const REDIRECT_URI = process.env.REDIRECT_URI || '{{REDIRECT_URI}}';
+const OAUTH_BASE = process.env.OAUTH_BASE || '{{OAUTH_BASE}}';
+const OAUTH_REALM = process.env.OAUTH_REALM || '{{OAUTH_REALM}}';
+
+const realmPath = `${OAUTH_BASE}/realms/${OAUTH_REALM}/oauth`;
+
+// Read scopes from app-config.json (default to 'all' if missing/corrupt)
+let SCOPES = 'all';
+try {
+  const appConfig = JSON.parse(fs.readFileSync(path.join(__dirname, '..', '..', 'app-config.json'), 'utf-8'));
+  if (appConfig.auth && appConfig.auth.scopes) SCOPES = appConfig.auth.scopes.join(' ');
+} catch {
+  console.warn('Warning: Could not read app-config.json — defaulting scopes to "all".');
+}
+
+// Step 1: Redirect user to authorization page
+router.get('/login', (req, res) => {
+  const state = require('crypto').randomBytes(16).toString('hex');
+  tokenStore.setState(state);
+
+  const authUrl = `${realmPath}/authorize?` +
+    `response_type=code` +
+    `&client_id=${encodeURIComponent(CLIENT_ID)}` +
+    `&redirect_uri=${encodeURIComponent(REDIRECT_URI)}` +
+    `&state=${state}` +
+    `&scope=${encodeURIComponent(SCOPES)}`;
+
+  res.redirect(authUrl);
+});
+
+// Step 2: Handle the OAuth callback
+router.get('/callback', async (req, res) => {
+  const { code, state, error, error_description } = req.query;
+
+  if (error) {
+    console.error('OAuth error:', error, error_description || '');
+    return res.status(400).send(`Authorization denied: ${escapeHtml(error_description || error)}`);
+  }
+
+  if (!code || typeof code !== 'string') {
+    return res.status(400).send('Missing authorization code.');
+  }
+
+  if (state !== tokenStore.getState()) {
+    return res.status(400).send('Invalid state parameter.');
+  }
+
+  try {
+    // Step 3: Exchange authorization code for tokens
+    const tokenResponse = await axios.post(
+      `${realmPath}/token`,
+      new URLSearchParams({
+        grant_type: 'authorization_code',
+        client_id: CLIENT_ID,
+        client_secret: CLIENT_SECRET,
+        code,
+        redirect_uri: REDIRECT_URI,
+      }),
+      { headers: { 'Content-Type': 'application/x-www-form-urlencoded' } },
+    );
+
+    const { access_token, refresh_token, expires_in } = tokenResponse.data;
+    tokenStore.saveTokens({ access_token, refresh_token, expires_in });
+
+    // Step 4: Verify the access token via userinfo
+    const userInfoResponse = await axios.get(`${realmPath}/userinfo`, {
+      headers: { Authorization: `Bearer ${access_token}` },
+    });
+
+    // Step 5: Log token status (tokens are only visible in the browser)
+    console.log(`\nAccess token received (expires in ${expires_in}s)`);
+    console.log('Refresh token received');
+    console.log('View tokens in your browser (masked — click to reveal).');
+
+    // Set no-cache headers — tokens are sensitive (local development only)
+    res.set('Cache-Control', 'no-store, no-cache, must-revalidate');
+    res.set('Pragma', 'no-cache');
+    res.set('Expires', '0');
+    res.send(
+      `<html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Brevo OAuth — Success</title>${PAGE_STYLES}</head>` +
+      '<body>' +
+      '<div class="page-card">' +
+      '<h2>Authorization successful!</h2>' +
+      '<p class="subtitle">Tokens are masked for security. Click to reveal.</p>' +
+      '<div class="request-details"><strong>Authorization Request</strong><dl>' +
+      `<dt>Client ID</dt><dd>${escapeHtml(CLIENT_ID)}</dd>` +
+      `<dt>Redirect URI</dt><dd>${escapeHtml(REDIRECT_URI)}</dd>` +
+      `<dt>Scopes</dt><dd>${escapeHtml(SCOPES)}</dd>` +
+      '</dl></div>' +
+      '<div class="token-section">' +
+      `<p><strong>Access Token</strong> (expires in ${expires_in}s):</p>` +
+      '<div class="token-wrapper">' +
+      `<code class="token-value">${escapeHtml(access_token)}</code>` +
+      '<button class="reveal-btn">Click to reveal</button></div>' +
+      '<div style="margin-top:16px"><p><strong>Refresh Token:</strong></p>' +
+      '<div class="token-wrapper">' +
+      `<code class="token-value">${escapeHtml(refresh_token)}</code>` +
+      '<button class="reveal-btn">Click to reveal</button></div></div>' +
+      '</div>' +
+      '<p style="margin-top:16px"><a href="/auth/refresh">Refresh token</a></p>' +
+      '</div>' +
+      REVEAL_SCRIPT +
+      '</body></html>',
+    );
+  } catch (error) {
+    console.error('OAuth error:', error.response?.data || error.message);
+    res.status(500).send('Authorization failed. Check terminal for details.');
+  }
+});
+
+// Token refresh — exchanges the stored refresh token for a new access token
+router.get('/refresh', async (req, res) => {
+  const refreshToken = tokenStore.getRefreshToken();
+  if (!refreshToken) {
+    return res.status(400).send('No refresh token available. Complete /auth/login first.');
+  }
+
+  try {
+    const tokenResponse = await axios.post(
+      `${realmPath}/token`,
+      new URLSearchParams({
+        grant_type: 'refresh_token',
+        client_id: CLIENT_ID,
+        client_secret: CLIENT_SECRET,
+        refresh_token: refreshToken,
+      }),
+      { headers: { 'Content-Type': 'application/x-www-form-urlencoded' } },
+    );
+
+    const { access_token, refresh_token, expires_in } = tokenResponse.data;
+    tokenStore.saveTokens({ access_token, refresh_token, expires_in });
+
+    console.log(`\nAccess token refreshed (expires in ${expires_in}s)`);
+    console.log('View token in your browser (masked — click to reveal).');
+
+    res.set('Cache-Control', 'no-store, no-cache, must-revalidate');
+    res.set('Pragma', 'no-cache');
+    res.set('Expires', '0');
+    res.send(
+      `<html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Brevo OAuth — Token Refreshed</title>${PAGE_STYLES}</head>` +
+      '<body>' +
+      '<div class="page-card">' +
+      '<h2>Token refreshed!</h2>' +
+      '<p class="subtitle">Click to reveal the token.</p>' +
+      '<div class="token-section">' +
+      `<p><strong>Access Token</strong> (expires in ${expires_in}s):</p>` +
+      '<div class="token-wrapper">' +
+      `<code class="token-value">${escapeHtml(access_token)}</code>` +
+      '<button class="reveal-btn">Click to reveal</button></div>' +
+      '</div>' +
+      '<p class="footer-text">You can close this window and return to the terminal.</p>' +
+      '</div>' +
+      REVEAL_SCRIPT +
+      '</body></html>',
+    );
+  } catch (error) {
+    console.error('Refresh error:', error.response?.data || error.message);
+    res.status(500).send('Token refresh failed. Check terminal for details.');
+  }
+});
+
+module.exports = router;

package/dist/templates/files/src/oauth/package.json.tmpl

@@ -0,0 +1,15 @@
+{
+  "name": "{{APP_SLUG}}",
+  "version": "1.0.0",
+  "private": true,
+  "description": "My custom brevo app {{APP_NAME}}",
+  "main": "server.js",
+  "scripts": {
+    "start": "node server.js"
+  },
+  "dependencies": {
+    "axios": "^1.7.0",
+    "dotenv": "^16.4.0",
+    "express": "^4.21.0"
+  }
+}

package/dist/templates/files/src/oauth/server.js.tmpl

@@ -0,0 +1,226 @@
+// Test server — for local OAuth testing only. Not for production use.
+// Run with: brevo app start oauth
+
+const path = require('path');
+const fs = require('fs');
+
+const envPath = path.join(__dirname, '.env.local');
+if (!fs.existsSync(envPath)) {
+  console.error('\nError: .env.local not found at', envPath);
+  console.error('Copy .env.example to .env.local and fill in your credentials:\n');
+  console.error(`  Source: ${path.join(__dirname, '.env.example')}\n`);
+  process.exit(1);
+}
+
+require('dotenv').config({ path: envPath });
+
+if (!process.env.CLIENT_ID || !process.env.CLIENT_SECRET) {
+  console.error('\nError: CLIENT_ID and CLIENT_SECRET must be set in .env.local');
+  console.error('Get your credentials with: brevo app credentials --reveal-secret\n');
+  process.exit(1);
+}
+
+if (!process.env.OAUTH_BASE || process.env.OAUTH_BASE.startsWith('{{')) {
+  console.error('\nError: OAUTH_BASE is not set or contains a placeholder.');
+  console.error('Check your .env.local file and set a valid OAuth base URL.\n');
+  process.exit(1);
+}
+if (!process.env.OAUTH_REALM || process.env.OAUTH_REALM.startsWith('{{')) {
+  console.error('\nError: OAUTH_REALM is not set or contains a placeholder.');
+  console.error('Check your .env.local file and set a valid OAuth realm.\n');
+  process.exit(1);
+}
+
+const express = require('express');
+const authRouter = require('./handler');
+
+const app = express();
+const PORT = process.env.PORT || 3009;
+
+const REDIRECT_URI = process.env.REDIRECT_URI || '{{REDIRECT_URI}}';
+let SCOPES = 'all';
+try {
+  const appConfig = JSON.parse(fs.readFileSync(path.join(__dirname, '..', '..', 'app-config.json'), 'utf-8'));
+  if (appConfig.auth && appConfig.auth.scopes) SCOPES = appConfig.auth.scopes.join(' ');
+} catch {
+  console.warn('Warning: Could not read app-config.json — defaulting scopes to "all".');
+}
+const AUTH_URL = `${process.env.OAUTH_BASE}/realms/${process.env.OAUTH_REALM}/oauth/authorize`
+  + `?response_type=code`
+  + `&client_id=${encodeURIComponent(process.env.CLIENT_ID)}`
+  + `&redirect_uri=${encodeURIComponent(REDIRECT_URI)}`
+  + `&state=<random>`
+  + `&scope=${encodeURIComponent(SCOPES)}`;
+
+app.use('/auth', authRouter);
+
+app.use(express.urlencoded({ extended: true }));
+
+app.get('/', (req, res) => {
+  res.send(`<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <title>{{APP_NAME}} — OAuth Test</title>
+  <style>
+    *, *::before, *::after { margin: 0; padding: 0; box-sizing: border-box; }
+    body {
+      font-family: "Inter", -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif;
+      background: rgb(250, 245, 227);
+      min-height: 100vh;
+      display: flex;
+      flex-direction: column;
+      align-items: center;
+      justify-content: center;
+      padding: 40px 16px;
+    }
+    .brevo-logo {
+      margin-bottom: 32px;
+      display: flex;
+      align-items: center;
+      justify-content: center;
+    }
+    .brevo-logo svg { height: 48px; }
+    .card {
+      background: #fff;
+      border: 1px solid #e3e3e3;
+      border-radius: 16px;
+      padding: 40px;
+      width: 100%;
+      max-width: 500px;
+      text-align: center;
+    }
+    .card h2 {
+      color: #1b1b1b;
+      font-size: 22px;
+      margin-bottom: 6px;
+    }
+    .card p.sub {
+      color: #696969;
+      font-size: 14px;
+      margin-bottom: 24px;
+    }
+    .btn {
+      display: block;
+      width: 100%;
+      padding: 8px 16px;
+      border: none;
+      border-radius: 16px;
+      font-size: 16px;
+      font-weight: 600;
+      cursor: pointer;
+      text-decoration: none;
+      text-align: center;
+      margin-bottom: 12px;
+      height: 40px;
+      line-height: 24px;
+    }
+    .btn:hover { opacity: 0.9; }
+    .btn-primary { background: #1b1b1b; color: #fff; }
+    .btn-secondary {
+      background: #fff;
+      color: #1b1b1b;
+      border: 1px solid #cfcfcf;
+    }
+    .hint {
+      background: #f5f5f5;
+      border: 1px solid #e3e3e3;
+      border-radius: 16px;
+      padding: 10px 14px;
+      font-size: 13px;
+      color: #696969;
+      margin-bottom: 16px;
+      text-align: left;
+    }
+    .hint code {
+      background: rgba(0,0,0,0.06);
+      padding: 1px 5px;
+      border-radius: 3px;
+      font-size: 12px;
+    }
+    .auth-url {
+      background: #f5f5f5;
+      border: 1px solid #e3e3e3;
+      border-radius: 16px;
+      padding: 10px 14px;
+      font-size: 12px;
+      color: #696969;
+      text-align: left;
+      margin-bottom: 16px;
+      word-break: break-all;
+    }
+    .auth-url strong {
+      display: block;
+      font-size: 13px;
+      margin-bottom: 4px;
+      color: #1b1b1b;
+    }
+    .auth-url code {
+      font-family: monospace;
+      font-size: 11px;
+      color: #858585;
+    }
+    .footer {
+      margin-top: 16px;
+      color: #858585;
+      font-size: 12px;
+    }
+    .btn-primary, .btn-secondary { display: flex; align-items: center; justify-content: center; gap: 8px; }
+    .spinner {
+      display: none;
+      width: 16px;
+      height: 16px;
+      border: 2px solid rgba(0,0,0,0.15);
+      border-top-color: #1b1b1b;
+      border-radius: 50%;
+      animation: spin 0.6s linear infinite;
+    }
+    .btn-primary .spinner { border-color: rgba(255,255,255,0.3); border-top-color: #fff; }
+    .btn.loading .spinner { display: inline-block; }
+    .btn.loading { pointer-events: none; opacity: 0.7; }
+    @keyframes spin { to { transform: rotate(360deg); } }
+  </style>
+</head>
+<body>
+  <div class="brevo-logo">
+    <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 90 28" fill="none">
+      <path fill="#0B996E" d="M73.825 17.178c0-4.037 2.55-6.876 6.175-6.876 3.626 0 6.216 2.838 6.216 6.876 0 4.04-2.59 6.716-6.216 6.716-3.626 0-6.175-2.8-6.175-6.716Zm-3.785 0c0 5.957 4.144 10.155 9.96 10.155 5.816 0 10-4.198 10-10.155 0-5.957-4.144-10.314-10-10.314-5.857 0-9.96 4.279-9.96 10.314ZM50.717 7.104l7.81 19.989h3.665l7.81-19.99h-3.945l-5.658 15.433h-.08L54.662 7.104h-3.945Zm-15.18 9.354c.239-3.679 2.67-6.156 5.977-6.156 2.867 0 5.02 1.84 5.338 4.598h-6.614c-2.35 0-3.626.28-4.58 1.56h-.121v-.002Zm-3.784.6c0 5.957 4.183 10.274 9.96 10.274 3.904 0 7.33-1.999 8.803-5.158l-3.186-1.6c-1.115 2.079-3.267 3.318-5.618 3.318-2.83 0-5.379-2.159-5.379-4.238 0-1.078.718-1.56 1.753-1.56h12.63v-1.078c0-5.997-3.825-10.155-9.323-10.155-5.497 0-9.641 4.278-9.641 10.195M20.916 27.09h3.586V14.82c0-2.64 1.632-4.519 3.905-4.519.956 0 1.951.32 2.43.759.359-.96.917-1.918 1.753-2.878-.957-.799-2.59-1.32-4.184-1.32-4.382 0-7.49 3.278-7.49 7.956v12.274-.002ZM3.586 13.86V4.104h5.896c1.992 0 3.307 1.16 3.307 2.918 0 1.999-1.713 3.518-5.218 4.677-2.39.76-3.466 1.4-3.865 2.16l-.12.001Zm0 9.795v-4.077c0-1.8 1.514-3.558 3.626-4.238 1.873-.64 3.425-1.28 4.74-1.959 1.754 1.04 2.829 2.838 2.829 4.718 0 3.198-3.028 5.556-7.132 5.556H3.586ZM0 27.093h7.968c6.057 0 10.597-3.798 10.597-8.835 0-2.76-1.394-5.237-3.864-6.837 1.275-1.28 1.873-2.759 1.873-4.558 0-3.717-2.67-6.196-6.693-6.196H0v26.426Z"/>
+    </svg>
+  </div>
+
+  <div class="card">
+    <h2>{{APP_NAME}}</h2>
+    <p class="sub">Local OAuth testing server</p>
+    <p class="hint">Before starting, make sure the redirect URL in <code>app-config.json</code> matches this server's port (<code>${PORT}</code>).</p>
+    <div class="auth-url">
+      <strong>Authorization URL</strong>
+      <code>${AUTH_URL}</code>
+    </div>
+    <a href="/auth/login" id="start-btn" class="btn btn-primary"><span>Start OAuth Flow</span><span class="spinner"></span></a>
+    <a href="/auth/refresh" id="refresh-btn" class="btn btn-secondary"><span>Refresh Token</span><span class="spinner"></span></a>
+    <p class="footer">Running on localhost &middot; Not for production use</p>
+  </div>
+  <script>
+    document.querySelectorAll(".btn").forEach(function (btn) {
+      btn.addEventListener("click", function () { btn.classList.add("loading"); });
+    });
+    window.addEventListener("pageshow", function () {
+      document.querySelectorAll(".btn.loading").forEach(function (btn) { btn.classList.remove("loading"); });
+    });
+  </script>
+</body>
+</html>`);
+});
+
+app.listen(PORT, '127.0.0.1', () => {
+  const url = `http://localhost:${PORT}`;
+  console.log(`\nTest server running at ${url}`);
+  console.log(`Opening browser...\n`);
+
+  const { execFile } = require('child_process');
+  const open = process.platform === 'darwin' ? ['open', [url]]
+    : process.platform === 'win32' ? ['cmd', ['/c', 'start', url]]
+    : ['xdg-open', [url]];
+  execFile(open[0], open[1], () => {});
+});

package/dist/templates/files/src/oauth/token-store.js.tmpl

@@ -0,0 +1,39 @@
+// In-memory token store — replace with your database in production
+
+let tokens = {};
+let csrfState = null;
+
+module.exports = {
+  saveTokens({ access_token, refresh_token, expires_in }) {
+    tokens = {
+      accessToken: access_token,
+      refreshToken: refresh_token,
+      expiresAt: Date.now() + expires_in * 1000,
+    };
+  },
+
+  getAccessToken() {
+    return tokens.accessToken;
+  },
+
+  getRefreshToken() {
+    return tokens.refreshToken;
+  },
+
+  isExpired() {
+    return !tokens.expiresAt || Date.now() >= tokens.expiresAt;
+  },
+
+  setState(state) {
+    csrfState = state;
+  },
+
+  getState() {
+    return csrfState;
+  },
+
+  clear() {
+    tokens = {};
+    csrfState = null;
+  },
+};

package/dist/templates/index.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Replace all occurrences of the given keys in a template string.
+ * Keys should include delimiters (e.g. '{{APP_NAME}}').
+ */
+export declare function applyVars(template: string, vars: Record<string, string>): string;
+/**
+ * Scaffold file manifest — maps output file paths to their .tmpl source files.
+ * Add new templates here; the scaffold command picks them up automatically.
+ */
+export interface TemplateFile {
+    /** Relative output path inside the scaffolded project */
+    outputPath: string;
+    /** Relative path inside templates/files/ */
+    templatePath: string;
+}
+export declare const TEMPLATE_MANIFEST: TemplateFile[];
+/**
+ * Load all templates from disk, apply variable substitution, and return
+ * an array of { name, content } ready to write.
+ */
+export declare function loadAllTemplates(vars: Record<string, string>): Array<{
+    name: string;
+    content: string;
+}>;
+export declare const oauthServerJsTemplate: string;
+export declare const oauthHandlerTemplate: string;
+export declare const tokenStoreJsTemplate: string;
+export declare const envExampleTemplate: string;
+export declare const envLocalTemplate: string;
+export declare const gitignoreTemplate: string;
+export declare const packageJsonTemplate: string;
+export declare const appConfigTemplate: string;
+export declare const agentsMdTemplate: string;
+export declare const claudeMdTemplate: string;
+export declare const readmeTemplate: string;
+//# sourceMappingURL=index.d.ts.map

package/dist/templates/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/templates/index.ts"],"names":[],"mappings":"AAaA;;;GAGG;AACH,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAMhF;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,yDAAyD;IACzD,UAAU,EAAE,MAAM,CAAC;IACnB,4CAA4C;IAC5C,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,eAAO,MAAM,iBAAiB,EAAE,YAAY,EAqB3C,CAAC;AAEF;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC3B,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAK1C;AAKD,eAAO,MAAM,qBAAqB,QAA2C,CAAC;AAC9E,eAAO,MAAM,oBAAoB,QAA4C,CAAC;AAC9E,eAAO,MAAM,oBAAoB,QAAgD,CAAC;AAClF,eAAO,MAAM,kBAAkB,QAA8C,CAAC;AAC9E,eAAO,MAAM,gBAAgB,QAA4C,CAAC;AAC1E,eAAO,MAAM,iBAAiB,QAAiC,CAAC;AAChE,eAAO,MAAM,mBAAmB,QAA8C,CAAC;AAC/E,eAAO,MAAM,iBAAiB,QAAuC,CAAC;AACtE,eAAO,MAAM,gBAAgB,QAAiC,CAAC;AAC/D,eAAO,MAAM,gBAAgB,QAAiC,CAAC;AAC/D,eAAO,MAAM,cAAc,QAAiC,CAAC"}